| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Fri, 17 Feb 2023 21:53:13 -0800
From: Dipanjan Das <mail.dipanjan.das@...il.com>
To: almaz.alexandrovich@...agon-software.com, nathan@...nel.org,
ndesaulniers@...gle.com, trix@...hat.com, ntfs3@...ts.linux.dev,
llvm@...ts.linux.dev,
Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Cc: syzkaller <syzkaller@...glegroups.com>,
Marius Fleischer <fleischermarius@...glemail.com>,
Priyanka Bose <its.priyanka.bose@...il.com>
Subject: BUG: unable to handle kernel NULL pointer dereference in ntfs_iget5
Hi,
We would like to report the following bug which has been found by our
modified version of syzkaller.
======================================================
description: BUG: unable to handle kernel NULL pointer dereference in ntfs_iget5
affected file: fs/ntfs3/super.c
kernel version: 6.2.0-rc5
kernel commit: 41c66f47061608dc1fd493eebce198f0e74cc2d7
git tree: kmsan
kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=a9a22da1efde3af6
crash reproducer: attached
======================================================
Crash log:
======================================================
loop2: detected capacity change from 0 to 1121
ntfs3: loop2: RAW NTFS volume: Filesystem size 0.00 Gb > volume size
0.00 Gb. Mount in read-only
BUG: kernel NULL pointer dereference, address: 0000000000000010
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 5d1bd067 P4D 5d1bd067 PUD 565e7067 PMD 0
Oops: 0000 [#1] PREEMPT SMP
CPU: 1 PID: 7167 Comm: syz-executor.2 Not tainted
6.2.0-rc5-00010-g41c66f470616 #8
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
RIP: 0010:ntfs_iget5+0x180/0x6bb0 fs/ntfs3/inode.c:519
Code: 85 50 ff ff ff 48 83 7d 90 00 0f 85 96 03 00 00 4d 8b 34 24 4c
89 e7 e8 ae b3 9c fe 49 83 c6 10 48 83 38 00 0f 85 89 03 00 00 <45> 8b
26 4c 89 f7 e8 b5 b2 9c fe 44 8b 28 44 8b 32 48 8b 45 a0 66
RSP: 0018:ffff88805640f5e0 EFLAGS: 00010246
RAX: ffff888011b09920 RBX: 0000000000000000 RCX: 0000000000059b2d
RDX: ffff888011f09920 RSI: 00000000005af2d0 RDI: ffffea000000000f
RBP: ffff88805640f8c0 R08: 0000000000000000 R09: ffff888011b09b00
R10: 0000000000000001 R11: 0000000000000000 R12: ffff888012309920
R13: 0000000000000000 R14: 0000000000000010 R15: 0000000000000002
FS: 00007fa54759d700(0000) GS:ffff88813fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000010 CR3: 000000005af4e000 CR4: 0000000000150ee0
Call Trace:
<TASK>
ntfs_fill_super+0x4225/0x6b10 fs/ntfs3/super.c:1044
get_tree_bdev+0x8a5/0xd50 fs/super.c:1282
ntfs_fs_get_tree+0x31/0x40 fs/ntfs3/super.c:1408
vfs_get_tree+0xa2/0x520 fs/super.c:1489
do_new_mount+0x6b7/0x15c0 fs/namespace.c:3145
path_mount+0x6fa/0x1ed0 fs/namespace.c:3475
do_mount fs/namespace.c:3488 [inline]
__do_sys_mount fs/namespace.c:3697 [inline]
__se_sys_mount+0x754/0x860 fs/namespace.c:3674
__x64_sys_mount+0xe0/0x140 fs/namespace.c:3674
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fa54648ff3e
Code: 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f
84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d
01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa54759c9e8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 00007fa54648ff3e
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007fa54759ca40
RBP: 00007fa54759ca80 R08: 00007fa54759ca80 R09: 0000000020000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000
R13: 0000000020000100 R14: 00007fa54759ca40 R15: 000000002007c6a0
</TASK>
Modules linked in:
CR2: 0000000000000010
---[ end trace 0000000000000000 ]---
RIP: 0010:ntfs_iget5+0x180/0x6bb0 fs/ntfs3/inode.c:519
Code: 85 50 ff ff ff 48 83 7d 90 00 0f 85 96 03 00 00 4d 8b 34 24 4c
89 e7 e8 ae b3 9c fe 49 83 c6 10 48 83 38 00 0f 85 89 03 00 00 <45> 8b
26 4c 89 f7 e8 b5 b2 9c fe 44 8b 28 44 8b 32 48 8b 45 a0 66
RSP: 0018:ffff88805640f5e0 EFLAGS: 00010246
RAX: ffff888011b09920 RBX: 0000000000000000 RCX: 0000000000059b2d
RDX: ffff888011f09920 RSI: 00000000005af2d0 RDI: ffffea000000000f
RBP: ffff88805640f8c0 R08: 0000000000000000 R09: ffff888011b09b00
R10: 0000000000000001 R11: 0000000000000000 R12: ffff888012309920
R13: 0000000000000000 R14: 0000000000000010 R15: 0000000000000002
FS: 00007fa54759d700(0000) GS:ffff88813fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000010 CR3: 000000005af4e000 CR4: 0000000000150ee0
----------------
Code disassembly (best guess), 4 bytes skipped:
0: ff 48 83 decl -0x7d(%rax)
3: 7d 90 jge 0xffffff95
5: 00 0f add %cl,(%rdi)
7: 85 96 03 00 00 4d test %edx,0x4d000003(%rsi)
d: 8b 34 24 mov (%rsp),%esi
10: 4c 89 e7 mov %r12,%rdi
13: e8 ae b3 9c fe callq 0xfe9cb3c6
18: 49 83 c6 10 add $0x10,%r14
1c: 48 83 38 00 cmpq $0x0,(%rax)
20: 0f 85 89 03 00 00 jne 0x3af
* 26: 45 8b 26 mov (%r14),%r12d <-- trapping instruction
29: 4c 89 f7 mov %r14,%rdi
2c: e8 b5 b2 9c fe callq 0xfe9cb2e6
31: 44 8b 28 mov (%rax),%r13d
34: 44 8b 32 mov (%rdx),%r14d
37: 48 8b 45 a0 mov -0x60(%rbp),%rax
3b: 66 data16
--
Thanks and Regards,
Dipanjan
View attachment "repro.c" of type "text/x-csrc" (61886 bytes)
Download attachment "repro.syz" of type "application/octet-stream" (14783 bytes)
Powered by blists - more mailing lists